feat(webhooks): signed, idempotent outbound delivery

.github/workflows/ci-quality.yml

@@ -178,7 +178,7 @@ jobs:
       - name: Run tests with coverage
         working-directory: backend
         env:
-          DATABASE_URL: sqlite::memory:
+          DATABASE_URL: "sqlite::memory:"
           REDIS_URL: redis://127.0.0.1:6379
         run: |
           cargo llvm-cov \

.github/workflows/clippy.yml

@@ -22,7 +22,7 @@ jobs:
     # ONLY for `--lib` (production code). Tests are allowed to keep `.unwrap()`
     # / `.expect()` / `panic!` because they are the idiomatic way to express
     # preconditions and assertions in unit tests.
-    - name: Backend Clippy (lib: deny panic-lints; tests: warn)
+    - name: "Backend Clippy (lib: deny panic-lints; tests: warn)"
       working-directory: ./backend
       run: |
         cargo clippy --lib -- \

.github/workflows/coverage.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Run tests with coverage
         working-directory: backend
         env:
-          DATABASE_URL: sqlite::memory:
+          DATABASE_URL: "sqlite::memory:"
           REDIS_URL: redis://127.0.0.1:6379
         run: |
           cargo llvm-cov \

.github/workflows/vault-deploy-approle.yml

@@ -13,6 +13,8 @@ env:
 jobs:
   test-with-approle:
     runs-on: ubuntu-latest
+    env:
+      VAULT_AUTH_CONFIGURED: ${{ secrets.VAULT_ADDR != '' && secrets.VAULT_ROLE_ID != '' && secrets.VAULT_SECRET_ID != '' }}
     steps:
       - uses: actions/checkout@v4
 
@@ -23,12 +25,12 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Set fallback JWT secret when Vault credentials are unavailable
-        if: ${{ secrets.VAULT_ADDR == '' || secrets.VAULT_ROLE_ID == '' || secrets.VAULT_SECRET_ID == '' }}
+        if: ${{ env.VAULT_AUTH_CONFIGURED != 'true' }}
         run: |
           echo "JWT_SECRET=fallback-test-secret-value-at-least-32-characters" >> $GITHUB_ENV
 
       - name: Authenticate to Vault with AppRole
-        if: ${{ secrets.VAULT_ADDR != '' && secrets.VAULT_ROLE_ID != '' && secrets.VAULT_SECRET_ID != '' }}
+        if: ${{ env.VAULT_AUTH_CONFIGURED == 'true' }}
         id: vault-auth
         run: |
           TOKEN=$(curl -s -X POST \

.github/workflows/vault-deploy.yml

@@ -13,6 +13,8 @@ env:
 jobs:
   test:
     runs-on: ubuntu-latest
+    env:
+      VAULT_AUTH_CONFIGURED: ${{ secrets.VAULT_ADDR != '' }}
     permissions:
       contents: read
       id-token: write  # Required for GitHub OIDC token
@@ -27,13 +29,13 @@ jobs:
         uses: Swatinem/rust-cache@v2
 
       - name: Set fallback test secrets when Vault is unavailable
-        if: ${{ secrets.VAULT_ADDR == '' }}
+        if: ${{ env.VAULT_AUTH_CONFIGURED != 'true' }}
         run: |
           echo "JWT_SECRET=fallback-test-secret-value-at-least-32-characters" >> $GITHUB_ENV
           echo "DATABASE_URL=sqlite::memory:" >> $GITHUB_ENV
 
       - name: Get Vault Token via GitHub OIDC
-        if: ${{ secrets.VAULT_ADDR != '' }}
+        if: ${{ env.VAULT_AUTH_CONFIGURED == 'true' }}
         id: vault-auth
         run: |
           TOKEN=$(curl -s -X POST \

.gitignore

@@ -54,3 +54,7 @@ benchmarks/baseline.json
 /public/worker-*.js.map
 /public/fallback-*.js
 /public/fallback-*.js.map
+
+# Rust backend build
+backend/target/
+